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Introduction 


The Information Commissioner is seeking feedback on her draft code of 
practice Age appropriate design - a code of practice for online services 
likely to be accessed by children (the code). 


The code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. 


The code is now out for public consultation and will remain open until 31 
May 2019. The Information Commissioner welcomes feedback on the 
specific questions set out below. 


Please send us your comments by 31 May 2019. 


Download this document and email to: 


ageappropriatedesign@ico.org.uk 


Print off this document and post to: 
Age Appropriate Design code consultation 
Policy Engagement Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the consultation please 
telephone 0303 123 1113 and ask to speak to the Policy 
Engagement Department about the Age Appropriate Design code or 


email_ageappropriatedesign@ico.org.uk 


Privacy statement 


For this consultation, we will publish all responses except for those where 
the respondent indicates that they are an individual acting in a private 
capacity (e.g. a member of the public or a parent). All responses from 
organisations and individuals responding in a professional capacity (e.g. 
academics, child development experts, sole traders, child minders, 
education professionals) will be published. We will remove email 
addresses and telephone numbers from these responses but apart from 
this, we will publish them in full. 


For more information about what we do with personal data, please see 
our privacy notice. 


Section 1: Your views 


Q1. Is the ‘About this code’ section of the code clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q2. Is the ‘Services covered by this code’ section of the code clearly 
communicated? 


No 

The general purpose of this section is clear, however, the terminology 
used is confusing, particularly in relation to "information society service" 
and what services the code specifically applies to. We recognise that 
this may be more accessible to those who are involved in the 
development of and provision of the services included in this section. 


Standards of age-appropriate design 


Please provide your views on the sections of the code covering each of 
the 16 draft standards 


1. Best interests of the child: The best interests of the child should be 
a primary consideration when you design and develop online services 
likely to be accessed by a child. 


2. Age-appropriate application: Consider the age range of your 
audience and the needs of children of different ages. Apply the standards 
in this code to all users, unless you have robust age-verification 
mechanisms to distinguish adults from children. 


3. Transparency: The privacy information you provide to users, and 
other published terms, policies and community standards, must be 
concise, prominent and in clear language suited to the age of the child. 
Provide additional specific ‘bite-sized’ explanations about how you use 
personal data at the point that use is activated. 


4. Detrimental use of data: Do not use children’s personal data in ways 
that have been shown to be detrimental to their wellbeing, or that go 
against industry codes of practice, other regulatory provisions or 
Government advice. 


5. Policies and community standards: Uphold your own published 
terms, policies and community standards (including but not limited to 
privacy policies, age restriction, behaviour rules and content policies). 


6. Default settings: Settings must be ‘high privacy’ by default (unless 
you can demonstrate a compelling reason for a different default setting, 
taking account of the best interests of the child). 


7. Data minimisation: Collect and retain only the minimum amount of 
personal data necessary to provide the elements of your service in which 
a child is actively and knowingly engaged. Give children separate choices 
over which elements they wish to activate. 


8. Data sharing: Do not disclose children’s data unless you can 
demonstrate a compelling reason to do so, taking account of the best 
interests of the child. 


9. Geolocation: Switch geolocation options off by default (unless you can 
demonstrate a compelling reason for geolocation, taking account of the 
best interests of the child), and provide an obvious sign for children when 


location tracking is active. Options which make a child’s location visible to 
others must default back to off at the end of each session. 


10. Parental controls: If you provide parental controls give the child 
age appropriate information about this. If your online service allows a 
parent or carer to monitor their child’s online activity or track their 
location, provide an obvious sign to the child when they are being 
monitored. 


11. Profiling: Switch options based on profiling off by default (unless you 
can demonstrate a compelling reason for profiling, taking account of the 
best interests of the child). Only allow profiling if you have appropriate 
measures in place to protect the child from any harmful effects (in 
particular, being fed content that is detrimental to their health or 
wellbeing). 


12. Nudge techniques: Do not use nudge techniques to lead or 
encourage children to provide unnecessary personal data, weaken or turn 
off privacy protections, or extend use. 


13. Connected toys and devices: If you provide a connected toy or 
device ensure you include effective tools to enable compliance with this 
code 


14. Online tools: Provide prominent and accessible tools to help children 
exercise their data protection rights and report concerns. 


15. Data protection impact assessments: Undertake a DPIA 
specifically to assess and mitigate risks to children who are likely to 
access your service, taking into account differing ages, capacities and 
development needs. Ensure that your DPIA builds in compliance with this 
code. 


16. Governance and accountability: Ensure you have policies and 
procedures in place which demonstrate how you comply with data 
protection obligations, including data protection training for all staff 
involved in the design and development of online services likely to be 
accessed by children. Ensure that your policies, procedures and terms of 
service demonstrate compliance with the provisions of this code 


Q3. Have we communicated our expectations for this standard clearly? 
1. Best interests of the child 


Yes 


If NO, then please provide your reasons for this view. 


2. Age-appropriate application 
No 


Although the information around age-ranges (and related developmental 
stages) is provided, it is not as clearly set out as in the first section (Best 
Interests of the Child) reagrding formatting. This seems to be a lack of 
consistency regarding formatting which makes it more difficult to digest 
the information. It would be useful to have a conclusion of bullet points 
set out clearly at the end of each section. 

3. Transparency 

Yes 


If NO, then please provide your reasons for this view. 
4. Detrimental use of data 


Yes 
If NO, then please provide your reasons for this view. 


5. Policies and community standards 
Yes 


If NO, then please provide your reasons for this view. 
6. Default settings 
Yes 


If NO, then please provide your reasons for this view. 
7. Data minimisation 
Yes 


If NO, then please provide your reasons for this view. 
8. Data sharing 
Yes 


If NO, then please provide your reasons for this view. 
9. Geolocation 


Yes 


If NO, then please provide your reasons for this view. 
10. Parental controls 
No 


We largely think this standard is communicated clearly however, the 
setting of the age-ranges is key - and again considering developmental 
stages - and also the varience in some parent's approach and their 
willingness/relunctance to monitor. The presence of parental controls can 
give an impression of safety which may not be there as there is still a risk 
that this is dependent on a parent/carer's digital 
literacy/interest/time/access to technology. 

11. Profiling 

No 


The default setting set as 'off' is positive and providing young people with 
the choice over profiling is a positive however, this still provides young 
people with an opportunity to change the settings - with no guarantee of 
fully understanding them. Profiling of young people in general should be 
limited or only where it is a basic requiremet for the service (which in 
most cases is highly unlikely). 


12. Nudge techniques 
No 


We believe this standard should include more information about the 
impact that nudge techniques can have on the wellbeing of young people 
accessing services. The focus on the technology and the techniques is 
important but it is so important because of the effect it has and the 
behaviours it can lead to. 

13. Connected toys and devices 

Yes 


If NO, then please provide your reasons for this view. 
14. Online tools 
Yes 


If NO, then please provide your reasons for this view. 
15. Data protection impact assessments 
Yes 


If NO, then please provide your reasons for this view. 
16. Governance and accountability 


Yes 


If NO, then please provide your reasons for this view. 


Q4. Do you have any examples that you think could be used to illustrate 
the approach we are advocating for this standard? 


1. Best interests of the child 
No 
If YES, then please provide details. 


2. Age-appropriate application 
No 


If YES, then please provide details. 
3. Transparency 
Yes 


BBC Bitesize has clear and attention grabbing information around the 
privacy policies and cookies policies whenever you access their services. 
Scottish Book Trust's ‘What’s Your Story’ website provides a great 
example of a privacy policy that is age appropriate and easily 
understandable to young people. The website also clearly explains the 
rights that young people have, how their service supports these rights, 
and how young people can activate and exercise their rights. 

4. Detrimental use of data 


No 
If YES, then please provide details. 


5. Policies and community standards 
Yes 


The 5Rights Youth Leadership Group note positive experiences with 
reporting on Instagram. They have experienced fast reactions to any 
reports and post are taken down immediately. 

6. Default settings: 

No 


If YES, then please provide details. 
7. Data minimisation 
No 


If YES, then please provide details. 
8. Data sharing 


No 


If YES, then please provide details. 
9. Geolocation 
Yes 


We recognise that 'in app' default is different though and is set as 'on' 
but Snapchat alerts the user when Geolocation is on and automatically 
turns off when you end the session, allowing young people to be more 
informed about Geolocation use. 

10. Parental controls 

No 


If YES, then please provide details. 
11. Profiling 
No 


If YES, then please provide details. 
12. Nudge techniques 
No 


If YES, then please provide details. 


13. Connected toys and devices 
No 


If YES, then please provide details. 


14. Online tools 
Yes 


The CEOP badge provides a clear and recognisable link to reporting. This 
is available on a variety of platforms, for example, 
members.scouts.org.uk or kgsorkney.com has link to CEOP for students 
to be able to access reporting. 

15. Data protection impact assessments 

No 


If YES, then please provide details. 
16. Governance and accountability 


No 


If YES, then please provide details. 


Q5. Do you think this standard gives rise to any unwarranted or 
unintended consequences? 


1. Best interests of the child 
No 
If YES, then please provide your reasons for this view. 


2. Age-appropriate application 
Yes 


Whilst recognising the right to safety and support is key, the age-ranges 
identified could potentially clash with young people's right to access 
information and participate online, particularly if there is a disparity 
between a user's age, developmental age and digital skills and literacy. 
3. Transparency 

No 


If YES, then please provide your reasons for this view. 
4. Detrimental use of data 


No 
If YES, then please provide your reasons for this view. 


5. Policies and community standards 
No 


If YES, then please provide your reasons for this view. 
6. Default settings 
Yes 


Children and young people may not be able to fully access the services 
provided by a platform if default settings don't allow. 

7. Data minimisation 

Yes 


Setting the mininum data required may prove challenging, and this 
standard might push companies to find ways of building in elements that 
require additional information to be gathered. This could have unintended 
consequences for young people looking to engage. A young person's 
ability to access a service and participate in social engagment, 
particularly if centred around a specific app/site, if they are unable of 
unwilling to share ‘essential’ information. Again, whilst safety and support 
comes first, a young person's engagement with an app (for example) 
should not depend on how much data they are willing to trade. 

8. Data sharing 

No 


If YES, then please provide your reasons for this view. 
9. Geolocation 
No 


If YES, then please provide your reasons for this view. 
10. Parental controls 
Yes 


Safety and support is paramount but this may result in young people 
withdrawing from a service if feeling they are being constantly monitored. 
The setting of the age-ranges is key - and again considering 
developmental stages - and also the varience in some parent's approach 
and their willingness/relunctance to monitor. There is still a risk that this 
is dependent on a parent/carer's digital literacy also. 

11. Profiling 
Yes 


Children and young people may not have the same access to targetted 
content that is appropriate and relevant to their interests or needs. 

12. Nudge techniques 

No 


If YES, then please provide your reasons for this view. 
13. Connected toys and devices 
No 


If YES, then please provide your reasons for this view. 
14. Online tools 
No 


If YES, then please provide your reasons for this view. 
15. Data protection impact assessments 
No 


If YES, then please provide your reasons for this view. 
16. Governance and accountability 


No 


If YES, then please provide your reasons for this view. 
Q6. Do you envisage any feasibility challenges to online services 
delivering this standard? 

1. Best interests of the child 


No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 


2. Age-appropriate application 
Yes 


It is difficult to ensure that age verification is robust and that users 
can't input false information - self-declared ages can lead to this. Being 
locked out also raises other issues - with Facebook if your are locked 
out of your account you must send photo identification/passport for 
verification. 

3. Transparency 

Yes 


There need to be greater clarity on what companies/services are being 
asked to be transparent about. 
4. Detrimental use of data 


No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 


5. Policies and community standards 
Yes 


There is a need to ensure the standards are consistent across platforms 
and apps for every service and provider. 

6. Default settings 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

7. Data minimisation 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

8. Data sharing 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

9. Geolocation 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 


10. Parental controls 
Yes 


It's a challenge to make sure that information is appropriate for each 
age range, which is why the definition of ages and developmental needs 
is key. This needs to be carefully considered and communicated to avoid 
confusion and to make it simple of parents and carers to understand. It 
is also important to provide information about positive use and the 
rights that young people, particularly those over 16 have to access 
services. 

11. Profiling 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

12. Nudge techniques 

Yes 


The Youth Leaders also see challenges in how the industry might 
interpret this standard. Could prompts/nudges be built into set up 
information? They may not be able to regularly prompt but could ask 
young people to provide additional information during app set up 
etc.The meaning of the Code must be explicit, so that lines cannot be 
blurred. 

13. Connected toys and devices 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

14. Online tools 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

15. Data protection impact assessments 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 
16. Governance and accountability 


No 
If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 


Q7. Do you think this standard requires a transition period of any longer 
than 3 months after the code come into force? 


1. Best interests of the child 


No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
BRights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 


2. Age-appropriate application 
Yes 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
BRights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 


The setting of age ranges/developmental stages is crucial to ensure 
young people are protceted but also not blocked from accessing 
information and services they are entitle to access. To ensure the 
categorisation of ages is correct and there are robust age-verification 
methods in place, this process needs to be given appropriate time, 
which may be longer that three months. 

3. Transparency 

No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

4. Detrimental use of data 


No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 


5. Policies and community standards 
No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
BRights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

6. Default settings 

No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

7. Data minimisation 

No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

8. Data sharing 

No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 


9. Geolocation 
No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

10. Parental controls 

No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

11. Profiling 

No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 


BRights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

12. Nudge techniques 

No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

13. Connected toys and devices 

No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

14. Online tools 

Yes 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 

15. Data protection impact assessments 

Yes 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 


Depending on the size of the organisation and the products/services 
provided, this could be a lengthy process but this will be on a case by 
case/organisation by organisation basis. We recognise this gives could 
be exploited to buy more time so organisations may have to justify any 
request for more time which would require an independent judgement 
made on whether this should be granted. 

16. Governance and accountability 


No 


Transition periods may need to vary slightly based on the specifics of 
each standard and the companies/services involved, however, the 
5Rights Youth Leadership Group believe the transition periods should be 
kep to a minimum and clear timings should be communicated. 


Q8. Do you know of any online resources that you think could be usefully 
linked to from this section of the code? 


1. Best interests of the child 


Yes 


Young Scot 5Rights Youth Commission report - 
https://www.youngscot.net/wp- 
content/uploads/2017/05/Five_Rights_Report_2017_May.pdf 


2. Age-appropriate application 
Yes 


Young Scot 5Rights Youth Commission report - 
https://www.youngscot.net/wp- 
content/uploads/2017/05/Five_Rights_Report_2017_May.pdf 
3. Transparency 

Yes 


Young Scot 5Rights Youth Commission report - 
https://www.youngscot.net/wp- 
content/uploads/2017/05/Five_Rights_Report_2017_May.pdf. 
4. Detrimental use of data 


Yes 


Young Scot 5Rights Youth Commission report - 
https://www.youngscot.net/wp- 
content/uploads/2017/05/Five_Rights_Report_2017_May.pdf 


5. Policies and community standards 
No 


If YES, then please provide details (including links). 
6. Default settings 
Yes 


https://young.scot/digiaye 
7. Data minimisation 
No 


If YES, then please provide details (including links). 
8. Data sharing 
Yes 


Young Scot 5Rights Youth Commission report - 
https://www.youngscot.net/wp- 
content/uploads/2017/05/Five_Rights_Report_2017_May.pdf 


https://young.scot/digiaye 


9. Geolocation 
Yes 


https://young.scot/digiaye 
10. Parental controls 
Yes 


https://young.scot/information/rights/what-can-you-do-at-what-age/ 
11. Profiling 
No 


If YES, then please provide details (including links). 
12. Nudge techniques 
No 


If YES, then please provide details (including links). 
13. Connected toys and devices 
No 


If YES, then please provide details (including links). 
14. Online tools 
Yes 


https://young.scot/digiaye 
15. Data protection impact assessments 
No 


If YES, then please provide details (including links). 
16. Governance and accountability 


No 


If YES, then please provide details (including links). 


Q9. Is the ‘Enforcement of this code” section clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q10. Is the ‘Glossary’ section of the code clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q11. Are there any key terms missing from the ‘Glossary’ section? 
No 


If YES, then please provide your reasons for this view. 


Q12. Is the ‘Annex A: Age and developmental stages’ section of the 
code clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q13. Is there any information you think needs to be changed in the 
‘Annex A: Age and developmental stages’ section of the code? 


Yes 


We acknowledge this section mentions age and developmental stages, 
but the 5Rights Youth Leadership Group would like to highlight that, 
despite being at the same age, no two young people are the same and 
their development needs or experiences could still differ greatly. The 
Youth Leadership Group encourages flexibility in the Code to allow case 
by case considerations of the individual young person, as grouping 
young people solely by age can risk overlooking the diversity of other 
factors that can have an impact on a young person’s maturity and 
ability to handle different situations. Alternatively, young people could 
be grouped by the actual developmental milestones reached instead of 
age. The 5Rights Youth Leadership Group are glad to see it touches 
upon literacy, however it doesn't explicitly mention ‘digital literacy’ i.e. 
young people who are at the younger end of the age range could be 
highly digitally literate and vice versa. A more all encompasing approach 
here would be beneficial to cover any grey-areas. 


Q14. Do you know of any online resources that you think could be 
usefully linked to from the "Annex A: Age and developmental 
stages’ section of the code? 


No 
If YES, then please provide details (including links). 


Q15. Is the ‘Annex B: Lawful basis for processing’ section of the 
code clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q16. Is this ‘Annex C: Data Protection Impact Assessments’ 
section of the code clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q17. Do you think any issues raised by the code would benefit from 
further (post publication) work, research or innovation? 


Yes 


Developing online tools that are appropriate and relevant for young 
people will take time and funding to ensure it adheres to the code. 
Robust age verification to ensure children and young people are only 
accessing services and tools appropriately designed for their age range 
needs to be researched and developed to make sure they cannot be 
bypassed. It would be useful to have a condensed 'bitesized' and 
accessible versions of the code that are easy to quickly read and 
understand. 


Section 2: About you 


Åre you: 


A body representing the views or interests of children? 


Please specify: 


A body representing the views or interests of parents? 
Please specify: 


DUE TO DOCUMENT FORMATTING, WE ARE UNABLE TO 
ADD THIS ABOVE IN 'A body representing the views or 
interests of children' so adding here: 


Young Scot is the national youth information and 
citizenship charity in Scotland working with young people 
aged 11-26 across Scotland. The response given in this 
document was prepared by the Young Scot 5Rights Youth 
Leadership Group. Launched in February 2018 by Young 
Scot, the Scottish Government, and 5Rights, the Young 
Scot 5Rights Youth Leadership Group is a diverse group 


of 30 young people from across Scotland, aged 11 to 19, 
who champion their rights in the digital world. Their work 
builds on the recommendations co-designed by the 
Young Scot 5Rights Youth Commission in their report, 
"Qur Digital Rights”, from May 2017, and focuses on 
investigating how these recommendations can be 
implemented and how young people’s rights can be 
realised in the digital world in practice. Specifically, the 
Youth Leaders have explored how young people can 
support each other around their digital rights, the role 
that businesses can play in realising young people’s 
rights, what cyber resilience means to young people, and 
how innovative technology can help young people 
exercise their rights in the digital world. As part of 2018 
the Year of Young People in Scotland, the Youth Leaders 
also hosted a 5Rights Summit for young people and the 
British Irish Council Administrations to celebrate and 
raise awareness of 5Rights. 


A child development expert? 


Please specify: 


An Academic? 


Please specify: 


An individual acting in another professional capacity? 


Please specify: 


A provider of an ISS likely to be accessed by children? 


Please specify: 


A trade association representing ISS providers? 


Please specify: 


An individual acting in a private capacity (e.g. someone 
providing their views as a member of the public of the 
public or a parent)? 


An ICO employee? 


Other? 


Please specify: 


Thank you for responding to this consultation. 


We value your input. 


